605e66f65ef3bdde0ad2600f64a7b5a9_JaffaCakes118

General

Target
605e66f65ef3bdde0ad2600f64a7b5a9_JaffaCakes118
Size 704KB
Sample240520-v9568abf4y
SHA256 b94dded29e7e24286f6bd3c9d6da75f2f7159bbe915d34be9e9924d86b0bed0b
MD5 605e66f65ef3bdde0ad2600f64a7b5a9
SHA1 8a221f4bef7dda26d23c3a6e2be1f2077984ddf0
SHA512 57244f3e5f8ca7300784d5aa7726a14c90f9df7ca5a1998073784772685b0d6fdf656b083d0a509ea57f731389aaa32eb01955f33437f5b1cdd300f5354e92d1
SSDEEP 12288:WIlkcMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMMMMMMMMMMMMMMMMMMMMMV:WEkcMMMMMMMMMMMMMMMMMMMMMMMMMMMc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
605e66f65ef3bdde0ad2600f64a7b5a9_JaffaCakes118

File Explorer

605e66f65ef3bdde0ad2600f64a7b5a9_JaffaCakes118

.exe 704KB

605e66f65ef3bdde0ad2600f64a7b5a9_JaffaCakes118

IMPHASH e825205454d6587faa691258aee1077e
SHA256 b94dded29e7e24286f6bd3c9d6da75f2f7159bbe915d34be9e9924d86b0bed0b
MD5 605e66f65ef3bdde0ad2600f64a7b5a9
SHA1 8a221f4bef7dda26d23c3a6e2be1f2077984ddf0
SHA512 57244f3e5f8ca7300784d5aa7726a14c90f9df7ca5a1998073784772685b0d6fdf656b083d0a509ea57f731389aaa32eb01955f33437f5b1cdd300f5354e92d1
SSDEEP 12288:WIlkcMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMMMMMMMMMMMMMMMMMMMMMV:WEkcMMMMMMMMMMMMMMMMMMMMMMMMMMMc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

36035

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\Mr.Anderson\Desktop\2008\27.8.20\Forti\Release\Forti.pdb

kernel32

GetLastError VirtualAlloc ExitProcess GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoA InterlockedCompareExchange Sleep InterlockedExchange GetSystemTimeAsFileTime

user32

SendMessageA InSendMessage CreateWindowExA ShowWindow

msvcp90

?eof@?$char_traits@D@std@@SAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBEHXZ ?length@?$char_traits@D@std@@SAIPBD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?good@ios_base@std@@QBE_NXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?uncaught_exception@std@@YA_NXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?width@ios_base@std@@QAEHH@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z

msvcr90

strchr ??3@YAXPAX@Z _findclose _findnext64i32 fwrite printf fputc fgetc strftime _localtime64 fread strlen putchar free sscanf __CxxFrameHandler3 strcmp ??2@YAPAXI@Z _wcslwr malloc _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode _encode_pointer __set_app_type _crt_debugger_hook ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit _decode_pointer _except_handler4_common _invoke_watson _controlfp_s strcpy strcat _findfirst64i32 fopen ftell fseek fclose strncpy system

Sharing

General

Malware Config

Signatures

File Explorer

605e66f65ef3bdde0ad2600f64a7b5a9_JaffaCakes118

kernel32

user32

msvcp90

msvcr90

generic